SharePoint Troubleshooting: A Critical Analysis of the Bamboo System Log Manager

This is SharePoint Joel and I'm back with a follow up to a recent post on SharePoint logs and troubleshooting.  I promised to follow up my post with a review of Bamboo Solutions' SharePoint System Log Manager.  Yesterday I spent some time with the Bamboo System Log manager and I am happy to share my thoughts here.  I want to provide a critical review, so you'll see what I was looking for, and what I would want to see in future releases.

Bamboo's System Log Manager

Figure 1. Central Admin Operations

So you can see here in figure one that this Log Manager is integrated right into Central Admin.  That's very slick.  So with my farm I can actually get to all of the servers and all the relevant logs (that are included) right from a single interface.  Easy and intuitive so far.

First off, I kind of expected a client console.  When I saw this as a Web based application I was a bit concerned since I know logs are long and can consume a lot of memory.  A lot of people I know would want to run this offline, and especially not on the production servers.  But the value in having this experience in the Web UI is that... there is no client footprint.  Once installed, everyone has access and power to use the tool.  Boom, it's integrated and feels just like the other Diagnostic logging and other access you have right here in the Central Admin UI.

The mouseover text "Bamboo Log Viewer" is quite telling. 

In Logging and Reporting...  (very well integrated.)  Click on the the link, and you're taken into the console of System Log Manager.

 Figure 2. System Log Manager console

This tree-based view is quite intuitive.  At the top you have the server name, and then you're seeing the top level nodes.

Top level Nodes:

• Custom View
• Windows Logs
• Application Logs

We'll come back to the custom view, and tell you what you get in the other nodes first. 

Seeing the Windows Logs is a pleasant surprise... seeing them in the Web UI and being able to see them from all servers in the farm is definitely cool.  From the Application, Security, and System logs... you've got what you'd get in the event viewer all on one page.  Clicking through the logs is a pain, but we'll get back to that in the custom view.  You can imagine how much slicker this would be if you could filter this.  Note the General or detailed pane for being able to get the information you need.

The Application logs... now we're really getting somewhere.  The Application logs contain the SharePoint ULS logs, the IIS Logs (YEAH, they actually have all of the client and server errors right in the Web UI).  You can click through the various Web applications to narrow down the logs then narrow it again by date.  This is one area I was surprised to see.  What would I want?  I'd want to be able to narrow this by error number.  I may want to ignore the 400 level errors.  Maybe I want to drill in to specific 503s, to see if there's a pattern.  Seeing the ULS logs right in the Web UI is very empowering since so many people don't even know they exist.  Popping back and forth between increasing the diagnostic levels and then viewing the logs in a click-through experience is pretty powerful.  Finally, seeing the SQL logs here I thought was again quite empowering.  The filtering is my concern. 

So with all these logs how do you narrow all this chaos down?

The Custom View is really the hook.  Give the view a name, choose the logs you want to look at, then choose the event level, and specify the time or simply choose "last 30 minutes."    Being able to narrow down the problem across my various logs to a specific time or to a specific set of logs.

Like it says, the event level is for those App, System, and Security logs, but that's where I'd want to see the IIS log filter by error number.  For things like the SQL log and the SharePoint ULS logs, you'd need some heuristics that would say here are your logs categorized, seeing those categories, and then being able to drill into those categories.

Other features that I liked here were the ability to set up these customized views and save them as reference.  So if I come back later, I can see what a certain type of issue or behavior looks like.

Figure 3. Custom View

So of this fairly comprehensive view, how does it line up with the pre-list of what logs you'd want to look at.  Not bad.  Great lineup.  There's very little that isn't included here.  For downtime-related issues you've got 90% of what you'd need.  I'd say worker process logs would be the other one I'd want to see.  Trace logs from IIS 7 (new) are great for troubleshooting issues with memory and worker process issues (related to custom code), but are often really drill down type scenarios just like SQL profiler/trace logs.  It isn't that quick access to narrow down a problem and solve it in 30 minutes type of troubleshooting session.  Note the drop down for server and not the ability to choose multiple servers and see all the data at once in a single view...  Also where's export to csv or excel?  I'd love to see that.

Ultimately, this log viewer gives us something we didn't have before.  An extremely intuitive interface for narrowing down a problem and viewing filtered logs, and hey its integrated, cheap and it is something you'd miss if you got used to using it.  I like that it brings these often ignored logs to the forefront.  Treating these logs on an equal footing will definitely reduce troubleshooting time and put the focus where it belongs.  With the time savings you'll get higher uptime and ramp up everyone that's touching these servers a lot quicker.  It doesn't feel like a third party product, and as you can imagine, an uninstall wouldn't impact your servers like some other solutions would.  Very small footprint with a big punch.

Enjoy,

Joel Oleson AKA SharePoint Joel